Restricted Advance Shell - examples of challenges

Hello!

Thank you for the detailed answer, looking from Sophos perspective it makes sense to disable shell access for licenses they can't fully control; As Home Licenses can be easily obtained without any challenges or verifications. But it's still a bit of an "extreme" decision to take. (From a home user perspective)

One of the biggest issues of not having access to advanced shell anymore is WAF Logging, which is still poor even now on v19 EAP 1.

An example, after the WAF rejects a request based on the protection's options, the logging inside the WebUI doesn't show the minimal necessary information to debug on why the request has been blocked - such as rule id which is necessary if you want to disable a certain filter, or more information over the pattern that WAF matched - and what protection category has been trigged, such as "Protocol Enforcement" or "XSS Attacks".

Anyways, thanks for the official answer!

+1! Not being able to determine the corresponding rule id for blocked actions renders the whole WAF pretty much useless.

You guys at Sophos have all your KBs, telling your customers and partners to use the advanced shell like in this specific case (https://support.sophos.com/support/s/article/KB-000035562?language=en_US), yet it doesn't come to your mind to just look for the answers in your very own knowledgebase? ‍♂️

WAF is a problematic field of being using Advanced Shell. The question for me (personally) are the use cases of XG Home with a WAF. 
What are you protecting with WAF as a Home user? Could you give us some particular use cases of this? 
Is it a home cloud (owncloud etc.) or what are you publishing with a XG Home? 

I specifically run my own Exchange Server for my private mail domain. This is a good opportunity to test out new updates or configurations and to find problematic WAF rules. Sure, I can just migrate my 3 mailboxes to MS365, but for me WAF on home devices was always a good opportunity to test something out in a somewhat real environment without to disrupt any businesses. Additionally I publish a synology NAS through WAF to use their cloud and web functionalities.

Are you a Sophos Partner or Customer? Just to understand the use case here. 

Are you a Sophos Partner or Customer? Just to understand the use case here. 

I am a partner. Since UTM the Home version was a good reason for many to check out Sophos firewall products in detail and I'm sure Sophos won many customers and partners just because of this version no one else offers. Sure, as a partner we get NFR licenses for our own firewall, but do I want to tinker arround with our production network? No. PMParth wrote that the support could still access the shell, but how should I interpret this? That the support is starting to actively support home users? Really?!

I don't see the point in all of this, except you'd tell me right now that Sophos has some clear evidence that the Home version is used commercially in a bigger scale, which I can't imagine is the case, but who knows?

If you would supply your partners and customers with an easy way to get NFRs for virtual devices, I'd probably be happy and leave you alone with this, though I still don't get the point.

Essentially Sophos as a company can still access the appliance in case of bug tracking or something. For example, a Home user discovers a bug in V19.0 and wants to report it. DEV can access the appliance and investigate this issue via SupportAccess. 

From my point of view as the most activate person in the community by far (see leader board), the advanced shell is not needed in the majority of "threads". Simply because the product is in a state of having a simple UI to get the most common issues configured or debugged via GUI. And i am talking about a new installation / configuration of a home appliance. Most home users have a average use case of simple setups. And most likely, if you look at the threads by home users, there are certain configuration issues, which do not need any interaction with the CLI. Most likely if i point to "do a packet capture" they are most comfortable with the packet capture in the GUI. 

Sophos Product management wants to gather open spots of still use cases, which the product does not cover (today). 

There are valuable contributions to this thread already. 

There are currently two different programs for Partners. The partner as a organisation can get NFR licenses for its own organisation. For example for the Firewall of the partner. Then there is a program for the education. If you are a Sophos Architect (you did the training and certification) you can get all Sophos products (and a 3 year Sophos Firewall subscription) for your own environment. 

Hi LuCar Toni, 

I'm a Sophos XG Architect, where can i find those three year license you are talking about?

Thanks.